I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (similar to 3DES).

Would this in any way reduce the statistical qualities of Aes Ctr? Security isn't a concern, but uniqueness of the generated random number sequences is. The reason I'm considering Aes is because it's built into .net and mono.

  • 2
    $\begingroup$ 3DES doesn't encrypt a counter multiple times. And AES-CTR as a CSPRNG is unique as long as the nonce is unique, which is a requirement for using counter mode. Why not just do that? $\endgroup$ – forest Dec 21 '18 at 4:23
  • $\begingroup$ @forest - 3DES uses encrypt(decrypt(encrypt(counter))) from what I understand, but that's besides the point. The reason I want to use a similar approach is because of the amount of key material I have and because of the state size of the random number generator I want to seed. $\endgroup$ – Thorham Dec 21 '18 at 4:38
  • 1
    $\begingroup$ No, it does not encrypt a counter. It encrypts one single block, like regular DES. $\endgroup$ – forest Dec 21 '18 at 6:35
  • $\begingroup$ Xorshifts don't have weak states (other than zero) so their seeding is trivial. 1,2,3... will work just as well as anything else. I'm the first to propose unusual solutions to problems, but from some experience I'm sensing that this is the classic XY problem. What do you really want to achieve with this? Are you simply looking for a large period? Remember that xor's aren't cryptographic and this is a crypto forum after all. And if the final quality is important, xorshifts are left wanting... $\endgroup$ – Paul Uszak Dec 21 '18 at 14:43
  • $\begingroup$ @Paul Uszak - Big state xorshifts definitely have weak states. Same as Mersenne twister, just not as bad. $\endgroup$ – Thorham Dec 22 '18 at 19:50

There is really no need to go beyond 256 bit security. If you want to combine multiple keys - presumably because you are not sure they provide enough security regardless of the size - then you could concat them and use them as Input Keying Material to a KBKDF that provides extraction as well as expansion (e.g. HKDF). Then the output can be used to seed your PRNG.

It seems you are trying to build your own KDF using CTR mode. Such KDF's already exist, but they generally don't provide extraction of the entropy, just expansion of statically sized (128, 192 or 256 bit) keying material. Proving that your scheme does extract entropy well will be tough to accomplish.

The only drawback of using HKDF for this is that the keying material must be in memory to perform the calculations; you should make sure that this is (1) possible and (2) possible to secure. How big this drawback is depends on the situation.

  • $\begingroup$ I'm not sure if you will agree with this answer; it offers no security proof of the extraction phase after all. But at least you now know what you're trying to do and the correct terms :) $\endgroup$ – Maarten Bodewes Dec 22 '18 at 0:26

If I understand your question correctly, you want to do use the output of the AES -CTR encryption as a seed for a PRNG with 1024bit states (so you need four outputs of the encryption).

So if you encrypt four times the all-zero-string using four different AES keys and concatenate the outputs, this should give you a statistical good and unique seed for your PRNG.

  • $\begingroup$ Not exactly. I need something like Aes with larger keys for seeding multiple instances of the PRNG. $\endgroup$ – Thorham Dec 21 '18 at 9:51
  • $\begingroup$ So you want the AES-CTR encryption be your 1024bit PRNG? $\endgroup$ – asante Dec 21 '18 at 12:58
  • $\begingroup$ @Thorham If security isn't a concern, then why do you need larger keys? $\endgroup$ – Ella Rose Dec 21 '18 at 15:12
  • $\begingroup$ @Ella Rose - World wide uniqueness. $\endgroup$ – Thorham Dec 21 '18 at 15:28
  • $\begingroup$ AES is a bijection, and if you feed it with an incrementing counter that does not repeat, then the outputs will never repeat. If you use multiple keys, this property disappears and you will end up with repeat outputs after a certain point... $\endgroup$ – Ella Rose Dec 21 '18 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.